Record Application Documentation Gaps in the Enterprise Risk Register

This chapter explains why known Application documentation gaps should be recorded in the Enterprise Risk Register, and how.

Why Documentation Gaps Belong in the Risk Register

Because documentation gaps are enterprise risks, they should be managed the way the enterprise manages its other risks: recorded, owned, assessed, and tracked to closure in the Enterprise Risk Register. Recording them there makes them visible to the same leaders and Risk and Compliance functions that oversee every other enterprise risk, and prevents them from being hidden inside IT.

Establish Risk Register Entries for Documentation Gaps

Create an Enterprise Risk Register entry whenever an Application documentation gap is known and not immediately closed, including:

• Gaps that block a Release.

• Gaps accepted through an approved exception, with the deadline by which they must be closed.

• Applications that miss the time-based deadline for conforming to a new template version.

• Applications that cannot conform, for example because no one with the necessary knowledge remains or because of vendor constraints.

Each entry should identify the affected Application, the gap, its potential impact, a Risk Owner, a remediation plan, and a deadline. Where the enterprise maintains an inventory of Knowledge Debt, the entry should reference the corresponding Knowledge Debt Items.

Document and Share Risk Register Entries

Reference each Risk Register entry from the Application’s documentation, and include open documentation risks in the Application’s conformance reporting until they are closed.

Best Practice: Record Application Documentation Gaps in the Enterprise Risk Register

It is a best practice to both establish and document the solution for managing documentation gaps as risks: record every known gap that is not immediately closed in the Enterprise Risk Register, with an owner, impact, remediation plan, and deadline, whether the gap blocks a Release, is accepted through an exception, misses a conformance deadline, or cannot be closed. Where the enterprise maintains an inventory of Knowledge Debt, link each entry to the corresponding Knowledge Debt Items.

Benefits: Placing documentation gaps alongside the enterprise’s other risks means they are assessed, prioritized, and funded by the same processes and the same people. It also ensures that a documentation gap accepted today cannot quietly disappear, because the Risk Register keeps it open until someone closes it.

Connections to Related IF4IT Practices and Inventories

The Application Portfolio Management (APM) Best Practices addresses assessing Application risk across the portfolio. The Technical Debt Management Best Practices addresses the related practice of recording and governing accumulated debt.